fix(ios): restrict authentication capabilities and validate bootstrap types

Require iOS 18.4 for explicit upload denial in the isolated authentication window. Add origin-bound generated download policy, app-switcher privacy, typed metadata regressions and original community icon assets. Seven portable tests and Swift formatting checks pass; Apple SDK validation remains external.

ios/Tests/ServerMetadataTests.swift

@@ -0,0 +1,21 @@
+import XCTest
+
+@testable import Yuvomi
+
+final class ServerMetadataTests: XCTestCase {
+    private let bootstrap = Data(#"{"app_name":"Yuvomi","setup_required":false,"password_reset_enabled":true}"#.utf8)
+    private let authentication = Data(#"{"enabled":false,"password_login_enabled":true}"#.utf8)
+    func testAcceptsActualAnonymousMetadataWithoutVersion() throws {
+        try ServerMetadata.validate(bootstrap: bootstrap, authentication: authentication)
+    }
+    func testRejectsNumericBooleanAndMissingAuthenticationMetadata() {
+        let numeric = Data(#"{"enabled":1,"password_login_enabled":true}"#.utf8)
+        XCTAssertThrowsError(try ServerMetadata.validate(bootstrap: bootstrap, authentication: numeric))
+        XCTAssertThrowsError(try ServerMetadata.validate(bootstrap: bootstrap, authentication: Data("{}".utf8)))
+    }
+    func testRejectsProxyHtmlAndInvalidJson() {
+        XCTAssertThrowsError(
+            try ServerMetadata.validate(bootstrap: Data("<html>SSO proxy</html>".utf8), authentication: authentication))
+        XCTAssertThrowsError(try ServerMetadata.validate(bootstrap: Data("null".utf8), authentication: authentication))
+    }
+}